GUEST PRIVACY POLICY

Last Updated: 06 – 12, 2025

Kempinski Hotels S.A. (Address: 10 Rue Henriette et Jeanne-Rath 1204 Genève, Switzerland) and its affiliates or subsidiaries, including but not limited to Key International Hotels Management Co Ltd. (Address: 12/F, NUO Center Office, No.2A Jiangtai Road Chaoyang District, Beijing, China) (hereafter collectively referred to as “Kempinski” or “We”), are committed to being responsible for processing your personal information.

Before you use or submit any personal information, please carefully review this Privacy Policy (this “Policy”). In particular, the terms marked in bold and underlined should be read more carefully. You should start using our products and/or services only after confirming that you fully understand and agree to all the terms of this Policy. We will continue to evaluate this Policy to reflect our personal information processing activities, and we may make changes to this Policy accordingly. Any changes will be made on this page, and you should check this page periodically for updates. If we make material changes to this Policy, we will provide you with notice when required by law.

This Policy contains the following sections:

1. Application and definition.
2. How we collect and use your personal information.
3. How we entrust others to process, share, transfer and make public your personal information.
4. Legal bases for processing your personal information.
5. How we use Cookies and similar technologies.
6. How we store your personal information.
7. How we protect your personal information.
8. Your rights.
9. How we protect personal information of children.
10. Links to other sites and services.
11. Updates.
12. Contact us.

1.     Application and definition

This Policy governs and describes Kempinski’s practices (as a personal information processor under China’s data and privacy law) in connection with personal information that we collect and process through different channels available for guests in mainland China as mentioned in Section 2 below.

This Policy applies to various products/services we provide to you through WeChat/Weibo official accounts, WeChat mini programs, websites, offline hotels and new forms that emerge with technological development (hereafter collectively referred to as “Services”). If we have provided you with a separate privacy policy for the Services we offer, then such separate privacy policy shall take precedence. Any matters not covered in such separate privacy policy shall be governed by this Policy.

This Policy does not apply to products/services provided by third parties within our Services. Personal information processing activities of third parties are subject to privacy policies or similar rules that provided to you separately by third parties. Please review such policies or rules before using third-party products/services.

Definitions of “personal information”, “sensitive personal information”, and “processing” in this Policy are set out as follows and are consistent with the definitions in the relevant laws.

Personal information: refers to various types of information recorded in electronic or other ways that is related to an identified or identifiable natural person, including but not limited to name, address, mobile phone number, and ID number, etc. but excluding anonymized information.

• Personal information processor: refers to an organization or individual that independently decides on the processing purposes and processing methods during personal information processing activities.
• Sensitive personal information: refers to personal information that, if leaked or used illegally, may easily lead to an infringement upon the human dignity of a natural person or endangerment of the safety of his/her body or property, including information on biometric identification, religious beliefs, specific identity, health care, financial accounts, and personal whereabouts, and personal information of minors under the age of fourteen. Sensitive personal information is in bold, italic and underlined to draw your attention.
• Processing: includes personal information collection, storage, use, processing, transmission, provision, disclosure and deletion, etc.

2.     How we collect and use your personal information

We will only collect and process your personal information for the following purposes described in this Policy in accordance with the principles of lawfulness, legitimacy, necessity and good faith and in compliance with applicable laws and regulations.

• Basic Business Function

Our basic business function is to provide you with Services related to hotel reservation. To enable us to provide you with basic business functions, you must authorize us to collect and use necessary information. If you refuse to provide the corresponding information, you will not be able to use our basic functions normally.

• Official WeChat Mini Program

When you make a booking through our official WeChat Mini Program, namely the “Kempinski Hotel Group(凯宾斯基酒店集团)” WeChat Mini Program, for the purpose of providing online hotel booking services to you, we will collect and use your personal information as follows:

• If you book domestic hotels (including hotels in Hong Kong, Macao, and Taiwan), we will collect and use your name, phone number, email address, payment method, and room reservation information (including order number, booking time, the city where the hotel is located, the name and room type of the hotel booked, check-in and check-out date, number of adults staying, and number of children staying).
• If you book overseas hotels, we will collect and use your name, phone number, email address, payment method, cardholder’s name, card type, card number, card expiration date, and room reservation information (including order number, booking time, the city where the hotel is located, the name and room type of the hotel booked, check-in and check-out date, number of adults staying, and number of children staying).

If you refuse to provide the above information, we will not be able to provide you with hotel reservation services through our official WeChat Mini Program.

• Official Website

When you make a booking through our official website (https://www.kempinski.com/cn), for the purpose of providing online booking services to you, we will collect and use your title (Mr./Ms., optional), name, country/region of residence, phone number, email address, payment method, cardholder’s name, card type, card number, card expiration date, and room reservation information (including order number, booking time, the city where the hotel is located, the name and room type of the hotel booked, check-in and check-out date, number of adults staying, and number of children staying). Among the above information, title (Mr./Ms.) and phone number are optional.

Aside from the optional information mentioned above, if you refuse to provide the above information, we will not be able to provide you with hotel reservation services through our official website.

• Offline Booking

When you fill out offline registration forms of temporary residence at our hotels, or when you arrive at the hotel and check in, for the purpose of providing on-site booking or check-in services to you, we may collect and use your name, date of birth (optional), certificate (such as passport or ID card) number, visa type, visa expiration, credit card information (including credit card number, expired date, card holder name and CV2), bank information for deposit, company contact name, gender (optional), nationality, private email address or business email address (optional), phone number (optional), membership number (if any, optional), company name (optional), job title (optional), private address or business address (optional) and payment method. Among the above information, date of birth, gender, email address, phone number, membership number, company name, job title, private address, business address     are optional.

Aside from the optional information mentioned above, if you refuse to provide the above information, we will not be able to provide you with on-site booking services.

• Safety Guarantee and Service Provision

To ensure the normal use and browsing of our online Services and to guarantee stability and security while you use our online Services, we may collect certain information through your browser or automatically through your device, including your device information (such as device model, operating system version, app version and build number), country and city, logs, IP address, and how you use our Services (such as page clicks and time spent).

• Additional Business Function

Our additional business functions include hotel search, contact information addition, activities participation, customer support, customer survey, additional services at hotels, personalised marketing communications and special offers, etc. To enable us to provide you with additional business functions, you have the option to authorize us to collect and use personal information required for these additional functions. Refusing to provide such personal information may result in the inability to use these additional functions as intended, but it will not impact the use of basic functions of our Services.

• Hotel Search

When you make a booking through our official WeChat Mini Program, for the purpose of facilitating your search for hotel information based on your location, you can authorize us to collect and use your location information. If you do not agree with us to process your location information, you can still search for hotel information by manually selecting a location.

• Contact Information Addition

When you make a booking through our official WeChat Mini Program, for the purpose of facilitating your addition of booking information, you can add frequently used contact information and provide us with the name, phone number, email address and detailed address of your frequent contacts. If you prefer not to provide us with the above information, you can enter the relevant booking information yourself. Please note that if you provide us with personal information of others, please ensure that you have obtained their valid consent in accordance with applicable laws before providing us with their personal information, or that there is another legal basis for doing so.

• Activities Participation

When you participate in marketing campaigns including but not limited to prize draws provided by our WeChat Official Account (i.e., “Kempinski Hotel Group (凯宾斯基酒店集团)”) and Weibo Official Account (i.e., “Kempinski Hotel Group_Kempinski (凯宾斯基酒店集团_Kempinski)”), for the purpose of providing you with incentive and sending you gifts, we may collect and use your name, contact details and mailing address. If you are not willing to provide us with the above information, we will be unable to provide you with incentive and gifts, but it will not affect your use of other Services provided by us.

• Customer Support

When you request customer support from us, for the purpose of ensuring the security of your account and personal information, we may need you to provide necessary personal information (such as name, phone number and email address) to verify your real identity. In addition, for the purpose of facilitating contact with you, assisting in resolving your issues promptly, or recording the solutions and handling results, we may retain records of your communications/calls and related content.

• Customer Survey

To enhance our service level and send you personalised communications tailored to your preferences and interests, we may conduct customer surveys with your consent. If you choose to participate in our customer surveys, we may collect information such as your name, phone number, email address, booking information, travel purpose, whether you’re traveling with children or pets, your favourite destinations, cuisine preferences, hobbies, sports, wellness activities, and events you enjoy during the survey process. If you are not willing to provide us with the above information, you may not be able to participate in our customer surveys, and we may not be able to send you personalised communications tailored to your preferences and interests according to customer survey results, but it will not affect your use of other Services provided by us.

• Additional Service Provided at a Hotel

When you use additional services provided by hotels (such as hotel WIFI, restaurants, spa, and wellness services), in order to provide you with relevant services or handle your booking requests, we may collect and use your name, telephone number, email address. If you are not willing to provide us with the above information, we will be unable to provide you with additional hotel services, but it will not affect your use of other Services provided by us.

• Personalised Marketing Communications and Special Offers

You have the option to agree or disagree to receive personalised marketing communications, newsletters and special offers from us. If you have already consented to receive our personalised marketing information by means of electronic communication, in order to send you communications that are tailored to your preferences and interests, help you learn about our offers and promotional activities, and provide you with a more personalised experience, we will process your booking information (including your previous and upcoming stay dates, aggregated booking data like your total number and average length of stays, revenues, booking lead time and preferred booking channel, hotel type and room category), membership information (including your membership details like membership number, membership level, relevant promotions, full name, email address, date of birth, home address, phone number, language preference for email communication and email marketing preferences), survey information (including travel purpose and whether you’re traveling with children or pets), preferences and interests information (including your preferences and interests like favorite destinations, cuisine preferences, hobbies, sports, wellness activities, and events you enjoy), and browsing information (including how you use and browse our Services), and send you marketing communications tailored to your preferences and interests via email and messaging platforms such as WeChat. You can withdraw your consent for receiving personalised marketing communications at any time. You can do this by clicking on the unsubscribe link included in each communication, or you can manage your preferences and withdraw your consent through the [“My” – “Personalised Communications” page of the official WeChat Mini Program], or you can contact us through the contact details listed at the end of this Policy to withdraw your consent to receive personalised marketing communications.

Below is the Personal Information Collection List for more details of the personal information we collect.

3.     How we entrust others to process, share, transfer and make public your personal information

• How we entrust others to process your personal information

In order to achieve the purposes above, we may entrust third-party service providers (including but not limited to software service providers, data analysis service providers, technical service providers and legal service providers) to assist us in providing relevant operation and service support. For companies, organizations and individuals who we entrust to process your personal information, we ask them to handle your personal information in accordance with our instructions, this Policy and applicable laws.

• How we share your personal information

We may share your personal information under the following circumstances:

• Sharing with your consent

After obtaining your consent, or in accordance with your request to share your personal information to third parties, we will share your personal information with third parties.

• Sharing under legal obligation

We may share your personal information as required by applicable laws and regulations, for the resolution of litigation, or in response to requests from administrative or judicial authorities in accordance with the law.

• Sharing necessary for the conclusion and fulfilment of contracts where you are a party

In cases where it is necessary to conclude and fulfil contracts where you are a party, your personal information may be shared with necessary third parties. We will only share the personal information necessary for the conclusion and fulfilment of contracts where you are a party.

• Sharing with our affiliates

To facilitate the provision of Services to you through our affiliates, including but not limited to Kempinski hotels, Nuo hotels and Bristoria hotels, your personal information may be shared with them. We will only share the necessary personal information and will be bound by the processing purposes, methods, and scope of personal information as stated in this Policy.

• Sharing with our business partners

Some of our Services are provided by third parties. At the same time, in order to provide you with more professional and secure Services, meet your needs and improve your user experience, our Services may integrate third-party Software Development Kits (SDKs). We will only share your personal information for legitimate, proper, necessary, specific, and explicit purposes, and only share the personal information necessary to provide Services. Furthermore, we will require our business partners to take adequate measures to protect your personal information.

• Other circumstances

We may share your personal information under other circumstances provided by applicable laws and regulations.

Below is the Third-Party Personal Information Sharing List for more details on the specific circumstances under which we share your personal information with third parties.

• How we transfer your personal information

If we need to transfer personal information due to reasons such as merger, division, dissolution or bankruptcy, we will inform you of the name and contact details of the recipient of your personal information. The recipient will continue to fulfil this Policy and other legal obligations. If the recipient changes the original purpose and method of processing, they will re-obtain your consent.

• How we make public your personal information

We may publicly disclose your personal information only in the following circumstances and under the premise of adopting security measures:

• Based on your needs or choice, or with your separate consent;
• When required by laws and regulations, mandatory administrative enforcement, or judicial requirements to publicly disclose your personal information;
• Other circumstances provided by applicable laws and regulations.

4.     Legal bases for processing your personal information

In most circumstances, we rely upon your consent to process your personal information. While under the relevant laws, we do not require your consent to process (including but not limited to, the collection, storage, use, processing, transmission, provision, disclosure, and deletion) your personal information when:

the processing is necessary for the conclusion or performance of a contract to which you are a contracting party;

• the processing is necessary to fulfill statutory functions or statutory obligations;
• the processing is necessary to respond to public health emergencies or protect the life, health or property safety of natural persons under emergency circumstances;
• personal information is processed within a reasonable scope to conduct news reporting, public opinion-based supervision, or other activities in the public interest;
• the personal information that has been disclosed by the individuals themselves or other personal information that has been legally disclosed is processed within a reasonable scope in accordance with this Law; or
• under any other circumstance as provided by any law or administrative regulation.

5.     How we use Cookies and similar technologies

When you make a booking through our official website, we may collect information from you through Cookies. You can click here to view our Cookie Policy for more details. We also include web beacons in HTML-formatted email newsletters in order to count how many newsletters (or particular articles, links, etc.) are being accessed, and on our website to count users who have visited these pages.

6.     How we store your personal information

• Retention Period

We only retain your personal information within the minimum period which is necessary for the fulfillment of the purposes stated in this Policy. Meanwhile, we will also store your personal information with adherence to the mandatory provisions about the retention period rising from applicable laws and regulations. For example, the PRC E-commerce Law stipulates that the retention period for product and service information, transaction information shall not be less than three years from the date of completion of the transaction. The PRC Civil Code stipulates that the limitation period for filing a lawsuit with the People’s Court to protect civil rights is three years. We determine the retention period for personal information mainly based on the following criteria and adopt the longer one:

• To complete the transaction related to you, maintain corresponding transaction and business records, and respond to your potential inquiries or complaints;
• To ensure the security and quality of the Services we provide to you;
• The longer retention period agreed upon by you;
• Whether there are any special agreements or laws and regulations regarding the retention period.

Upon the expiration of the retention period, we will delete your personal information or anonymize it in accordance with the requirements of applicable laws.

• Storage Location and Cross-Border Data Transfer

Personal information collected and generated during our operations in China will be stored within the territory of China (for the purpose of this Policy only, excluding Hong Kong, Macao, and Taiwan). We may transfer your personal information outside the territory of China under the following circumstances:

• With your separate consent;
• When you, as a party, engage in cross-border transactions through our Services, or it is necessary to conclude and perform other contracts where you are a party (such as booking overseas hotels);
• Other circumstances in accordance with applicable laws and regulations

Where your personal information is transferred to another jurisdiction outside mainland China, your personal information will be secured by appropriate safeguards as set forth under applicable laws. We will also require the overseas recipient to strictly protect your personal information. To the extent required under applicable laws and regulations, we will obtain separate consent from you before the transfer of your personal information.

If you need to exercise your rights related to personal information protection as stipulated by applicable laws against the overseas recipient, you can contact the overseas recipient via contact information mentioned in https://www.kempinski.com/en/contact-us.

7.     How we protect your personal information

We strive to maintain the appropriate standards of security and we have put in place robust technical and organisational measures for the protection of your personal information in accordance with the current state of the art technologies, especially to protect the data against loss, falsification or access by unauthorised third persons. However, the transmission of information via the internet is not completely secure. So, whilst we will do our best to protect your personal information, we cannot guarantee the security of your data transmitted to our servers. Once we have received your personal information we will use strict procedures and security features to prevent unauthorised access. Our internal processing takes place inside a VPN which is firewalled against the open internet and inside of which any kind of communication is processed in an encrypted way. As far as third parties (i.e. external companies) are rendering data processing services for us, we have committed them to the compliance with our data privacy regulations. The external service providers are supervised by our Global Data Protection Manager in terms of compliance with these regulations.

Where a personal information security incident occurs, we will inform you as required by the laws and regulations via mail, letter, telephone, pushed notification or other available means. Where it is difficult to inform the subjects of the personal information one by one, we may publish an announcement on our Services. Where required by law, we will also report the treatment result of the personal information security incident.

8.     Your rights

According to applicable law, you may have the following rights regarding your personal information:

• the right to know and the right to decide on the processing of your personal information;
• the right to restrict or refuse the processing of your personal information by others;
• the right to access, consult and duplicate your personal information;
• the right to request personal information processors to correct or supplement your personal information where you discover the information is incorrect or incomplete;
• the right to withdraw your consent to the processing of personal information based on your consent (but please note that your withdrawal of consent does not affect the validity of the processing of personal information that has been carried out based on your consent before the withdrawal);
• the right to request the transfer of personal information to your designated personal information processors;
• the right to delete your personal information under specific circumstances;
• the right to cancel your account.

You can access your order details (including order number, the name of hotel, check-in and check-out date, payment method, booking time) through the “My” page of the official WeChat Mini Program. If you want to withdraw your authorization for us to process your location information, you can manage the location information permission by clicking on the “…” in the upper right corner of the official WeChat Mini Program and then clicking on the “Settings”. If you want to withdraw your consent for receiving personalised marketing communications, you can click on the unsubscribe link included in each communication, or you can manage your preferences and withdraw your consent through the [“My” – “Personalised Communications” page of the official WeChat Mini Program]. You can also contact us via the contact information provided in this Policy to exercise your rights above. To protect the security of your personal information, we need to verify your identity in order to respond to your rights request(s), and we may not be able to respond to the request(s) for rights related to personal information that are not from you or authorized by you (for example, requests to consult personal information of someone else).

Additionally, the rights above are subject to limitations and exceptions under applicable law. For example, we will only respond to personal information transfer requests that meet all of the following conditions: 1) where the true identity of the person making the request can be verified; 2) where the personal information requested for transfer is the personal information that the individual has agreed to provide or has been collected on the basis of a contract; 3) where the transfer of personal information is technically feasible; and 4) where the transfer of personal information does not damage the legitimate rights and interests of others. In addition, If the number of requests for transfer of personal information significantly exceeds a reasonable range, we may charge necessary fees based on the costs of transferring personal information. We will respond to and comply with your request(s) consistent with applicable within 15 working days. If you have unresolved concerns, you also have the right to complain to relevant supervisory authorities or where applicable, file a lawsuit with the court in accordance with applicable law.

9.     How we protect personal information of children

We do not knowingly collect personal information from children under the age of 14 without parental/guardian consent. If you are the parent or guardian of your child and believe that we have personal information of your child without parental/guardian consent, or if you wish to withdraw such consent, please contact us via the contact information provided in this Policy and we will delete such information.

For more information about our practices related to the processing of information of children under the age of 14 can be found in our Child Guest Privacy Notice. If you are a child under the age of 14, before using our Services, you and your parent/guardian should carefully read our Child Guest Privacy Notice. Only after obtaining your parent/guardian’s consent to our Child Guest Privacy Notice, can you use our Services or provide us with your personal information under the guidance of your parent/guardian.

10. Links to other sites and services

Our Services may contain links to third-party websites, applications and other services. Please be aware that we are not responsible for the privacy practices of such other sites and services. We encourage you to be aware when you leave our Services and to read the privacy statements of each and every site you visit that collects your information.

11.  Updates

This Policy may be updated periodically. We will update the date at the top accordingly and encourage you to check for changes that we have made. On some occasions, we may also actively advise you of specific data handling activities or significant changes to this Policy, as required by applicable law. We encourage you to visit this Policy regularly to read the latest version.

12.  Contact us

If you have questions about this Policy or wish to contact us for any reason in relation to our personal information processing, please contact our Global Data Protection Manager at data.privacy@kempinski.com.

Personal Information Collection List

Third-Party Personal Information Sharing List